Summary The privately operated Piper PA-46-350P Jetprop DLX (registration C-FKKH, serial number4622092) had departed from Edmonton, Alberta, at about 0733 mountain daylight time en route to Winnipeg, Manitoba, on an instrument flight rules flight plan. Shortly after the aircraft levelled off at its cleared altitude of flight level (FL) 270, the aircraft was observed on radar climbing through FL274. When contacted by the controller, the pilot reported autopilot and gyro/horizon problems and difficulty maintaining altitude. Subsequently, he transmitted that his gyro/horizon had toppled and could no longer be relied upon for controlling the aircraft. The aircraft was observed on radar to make several heading and altitude changes, before commencing a right turn and a steep descent, after which the radar target was lost. An emergency locator transmitter signal was received by the Lloydminster, Alberta, Flight Service Station for about 1minutes before it stopped. The wreckage was found by the Royal Canadian Mounted Police about 16nautical miles northeast of Wainwright at about 1205. None of the five people on board survived. Ce rapport est galement disponible en franais. Other Factual Information History of the Flight The Piper PA-46-350P Jetprop DLX (C-FKKH) departed the Edmonton City Centre Airport (CYXD) at 0733 1 with the pilot and four passengers on board. After the pilot reported level at flight level (FL) 270 at 0751, the Edmonton Area Control Centre (ACC) radar confirmed that the aircraft was tracking 080 magnetic (M) with a ground speed of 250knots. At 0755, the ACC noticed the aircraft climbing above the assigned altitude and queried the pilot, who reported that he had an autopilot problem. The aircraft returned to FL270 about three minutes later, but within the next two minutes, descended to FL269, then climbed to FL274 before returning to FL270. At 0806, the pilot advised the ACC that his gyro/horizon had toppled and requested weather for Saskatoon and Regina, Saskatchewan, which he promptly received. At 0807, the pilot advised the ACC that he had lost his gyro/horizon again and requested a block of airspace 2 as well as the Regina weather. The ACC responded by advising the pilot that he was turning south through a track of 186M and descending. At 0808, the aircraft levelled off at FL260 with a track of 195M. It then climbed to FL265 while tracking 230M before beginning a constant descent. In this descent, the track varied from 218M to 243M. Over the next minute, the ACC advised the pilot that he was descending through FL244 and then FL232. An emergency locator transmitter (ELT) signal began transmitting at about 0810:30. The last encoded radar return from the aircraft was at 0811 at 9000feet above sea level (asl). The last non-encoded return (no altitude information) was about 30seconds later. The ELT transmission ceased at 0812. Until the final descent, the aircraft ground speed remained constant between 240and 260knots. On final descent, the ground speed dropped to 100knots, indicating a near vertical flight path. The aircraft was not equipped with a flight data recorder or a cockpit voice recorder, nor were they required by regulation. Wreckage Information The main aircraft wreckage was located in scrub brush approximately 16 nautical miles (nm) northeast of Wainwright, Alberta, at 5302.461' N and 11035.939' W at an elevation of 1901feetasl. The aircraft was oriented at 090M on a slight slope on the upper banks/river valley of the Battle River in about 18inches of snow. The lower fuselage was extensively crumpled, which is consistent with the aircraft striking the ground in a level attitude with a high vertical rate of descent. There were indications of a slight counter-clockwise rotation (yaw) as viewed from above. Propeller blade damage indicated that the propeller was rotating at the time of impact, although not under positive load. The right wing had failed under positive loading about 54inches outboard of the fuselage, and the outer panel struck the top of the cabin as indicated by the damage and paint and rubber transfers. Failure of the left wing was at about 88inches outboard of the fuselage, with the fracture surfaces displaying distortion under both positive and negative loading. There were no paint or material transfers on the outer panel. The vertical fin and the upper aft fuselage section, with about the lower third of the rudder attached, had separated as a unit. Both stabilizers, elevators, and trim tab had departed the aft fuselage, initiated by the failure of the right front stabilizer attachment fitting. The usual breakup sequence of an aircraft in a spiral dive is for the tail surfaces to fail under excessive negative aerodynamic loading as the pilot attempts to raise the nose to recover from the dive. Relieved of the aerodynamic download and the weight of the tail, the nose then rotates downward and unloads the wings, which fail under negative aerodynamic loading (bunting). C-FKKH's breakup sequence was initiated by the right wing failing under a positive load, followed by the left wing under a positive/negative load, then the tail from a twisting rotational load. All detached parts were found scattered along a narrow track for a distance of about 1.92nm, on a bearing of 333M from the fuselage. Examination of the fracture surfaces by the TSB Laboratory revealed that all failures were caused by structural overload, with no pre-existing deficiencies found. Analysis of the radar data indicated that the aircraft was in descent between 20000 and 16000feet asl when breakup occurred. The descent rate was in excess of 30000feet per minute with a peak forward speed of about 460knots calibrated airspeed (KCAS) or about 390knots indicated airspeed (KIAS). Certification testing on the original PA-46-350P included flutter dive testing up to about 266 KIAS. Pilot History The pilot was an executive within the A.D. Williams Group of companies who flew the corporate aeroplanes periodically. The pilot began his flight training in July1983 and held a Commercial Pilot Licence with a Group3 instrument flight rules (IFR) rating issued on 06December2007. At the time of the occurrence, the pilot had flown about 2200hours, of which about 987hours were in the PA-46-310P model and 166hours were on C-FKKH. On 02 and 03August2006, for his transition to the turbine-powered PA-46P Jetprop, the pilot received 5.7hours of training from Eclipse International, a company that specialized in training on the PA-46 series of aircraft. In addition to ground school, flight training included exercises in aircraft handling as well as instrument procedures, avionics, and autopilot/flight director failures, and recovery from unusual attitudes. Partial (limited) panel exercises were not included nor was there any requirement to do so. The pilot successfully passed his IFR proficiency flight test (PFT) on 05December2007. Partial panel exercises were not conducted during this PFT because they are not required as part of the Transport Canada (TC) IFR PFT. His last documented partial panel training was on 06May2001 during recurrent training on the previous company aircraft, a PA-46-310P. There was no record of whether the pilot had previously hand-flown C-FKKH without the assistance of the autopilot at altitude, in IFR conditions, for any period of time. The ground school portion of the initial PA-46P Jetprop training received by the pilot in August2006 covered aircraft weight and balance, gross take-off weight (GTOW), and centre of gravity (C of G) limits. Also covered were the actual payload the aircraft could handle and the weight limitations of the forward and aft cargo areas. A subsequent safety seminar attended by the occurrence pilot in June2007 emphasized the weight and balance issues, and the aft C of G issues in relation to stall speed, spins, and spirals. All pilot information was assembled from TC files, pilot and aircraft logbooks, courses, and seminar information because there were no company pilot training and qualification records as required by the company operations manual (COM). The COM is required under Section9.11 by the Canadian Business Aviation Association (CBAA) program. The instructors of three of the ground and flight safety courses on the PA-46 series aircraft stress that a partial panel is to be utilized in case of a gyro/horizon failure, instead of attempting to transition to the use of the backup electric gyro/horizon in the right side panel, due to the width of the panel and parallax issues. Weather The pilot obtained a verbal weather briefing from the Edmonton Flight Information Centre (FIC) based on Meteorological Service of Canada (MSC) forecasts. The pilot was advised that he may expect light mixed icing on the climb from 7000 to 12000feet with cloud tops at FL220. Clouds were expected to clear once in the vicinity of Lloydminster, Alberta. No significant meteorological condition was evident in the data for the departure and climb-out phases of this flight. The conditionally unstable atmosphere, local cloud decks, and weak shear layers might have resulted in occasional light-to-moderate turbulence on climb-out, but nothing that would normally have caused a problem for the aircraft. The relatively dry mid-levels through climb-out would have also minimized any icing potential beyond occasional light rime while traversing through cloud. Flight through mid-cloud layers to the east of CYXD would have increased the potential for icing as indicated by the Graphical Area Forecast (GFA) panels issued on that day. That the aircraft attained FL270 without incident, however, suggests that no difficulties were encountered on climb-out. Satellite imagery showed that later stages of the flight would have been over-flying extensive cloud layers associated with an inverted trough over east-central Alberta. With limited representative upper air information in the area, it was difficult to determine with certainty the actual height of the top of the main cloud deck associated with this system. Infrared satellite imagery indicates that cirrus cloud would have been associated with this system at or near FL270, but it would seem likely that the more active cloud decks were well below the FL270 cruising altitude of the aircraft. There was convective activity originating from the main cloud deck of the inverted trough. Radar echo tops during the flight indicated precipitation returns up to 20000feet asl. Forecaster assessments on that morning indicated scattered to numerous altocumulus castellanus cloud topped at FL220. An assessment of the 0600 Stony Plain, Alberta, upper air data, however, indicated the potential for additional isolated altocumulus castellanus development as high as FL250. As such, the possibility of significant turbulence and/or icing associated with altocumulus castellanus at that altitude cannot be ruled out. It is also important to note that, from the last recorded position of the aircraft at assigned altitude, any descent would have occurred through the extensive cloud layers below and likely resulted in minimal visual references to the ground or horizon. A Pilatus PC12 flew the route of the accident aircraft at FL270 approximately 15 minutes behind C-FKKH. The pilot reported light to nil icing in the climb with light turbulence through FL230. Once at FL270, the pilot was in and out of the cloud tops with no turbulence or icing, and with an outside temperature of -55C. The pilot reported that he was clear of cloud and had ground contact when he was east of Lloydminster, about 20nm east of the accident site. Aircraft Information The occurrence aircraft, originally a PA-46-350P, was manufactured in 1989. It had been modified in October2000 at 1265.4hours total time since new (TTSN) to the Jetprop DLX model with a PT6A-34 engine and Hartzell HC E4N 3N propeller in accordance with Supplemental Type Certificate (STC) ST00541SE by Jetprop L.L.C. The conversion also entailed major changes to the existing airframe, such as a new engine mount, redesigned cowling, fuel system (header tank), engine controls, indicating instruments, electrical systems, pressurization system, control switches, and backup vacuum system. The primary purpose of the conversion was to increase engine reliability. In March2003, at 1385.6hours total time (TT), the PT6A-34 engine was replaced with a PT6A-35 engine for better climb and high-altitude performance. Also incorporated at this time was STC SA00859AT to allow an additional 10 US gallons of fuel in each wing tank, for a total fuel capacity of 151 US gallons (1070.6pounds). The aircraft was imported into Canada in July2006 with 1609.9hours TTSN. The original PA-46-350P's maximum structural cruise speed (Vno) was 168 KIAS, with the maximum speed (Vne) of 198 KIAS at maximum gross weight. Following conversion, the more stringent United States Federal Aviation Administration (FAA) Part25 requirements applied, resulting in a maximum operating speed (Vmo) of 172 KIAS as the sole limitation. The original life limit for C-FKKH's wing was 15580hours time in service (TIS) and, for the fuselage, 10145hours TIS. After conversion, the reduced limits were calculated for the wing at 14148.5hours and the fuselage at 9257.0hours TIS due to the higher stresses of turbine operation. The Operating Altitude Limitations section of the PA-46-350P Pilot's Operating Handbook (POH) states Flight above 25000feet pressure altitude is not approved. STC ST00541SE, Section2.25 states Flight up to and including FL270 is approved if equipped with avionics in accordance with Federal Aviation Regulations (FAR) 91 or FAR 135. 3 The STC further states ...supplemental oxygen and a quick-donning mask must be available for the pilot for flight above FL250. Paragraph 605.32(3)(a) of the Canadian Aviation Regulations (CARs) states The pilot at the flight controls of an aircraft shall use an oxygen mask if the aircraft is not equipped with quick-donning oxygen masks and is operated at or above FL250. There were no quick-donning masks on board and the pilot was not wearing an oxygen mask at the time of the occurrence. There was no record of the pilot having received high-altitude indoctrination training as required in Section9.6 of the COM. Weight and Balance The aircraft weight was calculated to have been about 5157pounds at take-off and about 5012pounds at the time of the occurrence, with the C of G at 147.97inches aft of the datum. Maximum allowable GTOW was 4300pounds, with the C of G limits from 143.3inches to 147.1inches aft of the datum. As equipped and with full fuel, C-FKKH would have had a useful load of about 267pounds. Section6.3, Weight and Balance (WB) Control, of the COM states: The pilot-in-command is responsible for the proper loading, including load security, weight, and weight distribution. The load shall be distributed to ensure that the CofG will remain within the prescribed limits throughout the entire flight. The takeoff and landing limits shall not exceed the maximum weights specified in the approved Aircraft Flight Manual. There was no record of weight and balance calculations for any flights of this aircraft as required by Section3.3 of the COM. Company trip sheets recorded passenger names, thus the weight of passengers and fuel loads (unrecorded) were estimated according to trip segment times. During the period from 01June2007 to 30January2008, there were 12flights that departed with the GTOW of the aircraft above the maximum weights specified. Several additional flights most likely had departed with weights above maximum GTOW when IFR fuel reserves were included. Aircraft Handling The PA-46 series of aircraft have been characterized as having a sensitive (light) pitch control, which means that the elevator control requires very little effort to change the pitch attitude (nose up or nose down). The horizontal stabilizer and attached elevators normally operate under an aerodynamic download to balance the weight of the forward fuselage and engine. Manufacturer's calculations have determined that, due to the excess weight and out-of-envelope aft CofG position, the aerodynamic loading on the horizontal stabilizers on C-FKKH would have been reversed, from negative (download) to positive (upload). This condition would result in an increase in the pitch control sensitivity and a decrease in aircraft longitudinal stability. Control forces also become lighter with the lower air densities at higher altitudes. Lighter control forces would allow the pilot to induce higher loads (g) on the airframe with less effort. Aircraft Maintenance As per the requirements of subpart 605 of the CARs, an aircraft being operated on a private operator certificate (POC) can be maintained by an appropriately licensed and qualified aircraft maintenance engineer (AME). An approved maintenance program is required as well as the appropriate manuals and AME qualifications. The occurrence aircraft was being maintained by a local approved maintenance organization (AMO) approved for Piper single-engine, piston-powered aeroplanes but not the PA-46 Jetprop DLX. The last maintenance performed on C-FKKH was the removal, bench test, and reinstallation of the pilot's gyro/horizon and autopilot computer shortly before the occurrence flight. Previously, on 04February2008, a number of repairs were completed and some engine and airframe components were replaced. The last inspection was a 100-hour inspection on 08November2007 at 1810.1 airframe hours. Other than the gyro/horizon instability, there were no other reported unserviceabilities before the flight. Vacuum System The original factory-installed vacuum system consisted of two engine-driven vacuum pumps, one primary and one backup, and associated components and plumbing. C-FKKH's system was modified by the Jetprop DLX conversion to incorporate one engine-driven primary pump and a backup ejector-type vacuum system. The vacuum system operated the gyro/horizon on the left (the pilot's) side instrument panel and the directional indicator gyro on the right side instrument panel. All system components were examined and the only anomaly found was the vacuum gauge, an original factory-installed unit. Normal system operating vacuum is 4.8 to 5.2inches of mercury (in Hg), which is determined by using the aircraft's vacuum gauge as the reference for adjustment. Examination revealed that the gauge was reading higher than the actual vacuum in the system. At 4.8in Hg indicated on the gauge, the actual value was about 4.16in Hg, and at 5.2in Hg indicated, the actual value was about 4.58in Hg. There was no record of the gauge having been checked or calibrated since manufacture or during the engine conversion in October2000, nor was there required to be. The gyro/horizon manufacturer has advised that the minimum vacuum required for operation of the instrument was 4.5inHg. Instrument Examination All of the flight instruments, avionics, and autopilot components were examined in detail by the TSB with the manufacturers' representatives assisting. The autopilot components were sent to the manufacturers for further testing under TSB supervision. Particular emphasis was placed on the pilot's KingKI256 Flight Command Indicator gyro/horizon, serial number X16749. The primary trait of a rotating gyroscopic rotor is rigidity in space, or gyroscopic inertia. The spinning rotor maintains a constant attitude in space as long as no outside forces change its motion. This makes it ideal for use as an unchanging reference in such devices as attitude and heading indicators. The gyroscopic inertia of a spinning rotor increases as its mass and spin rate increase. Another characteristic of a gyroscope is precession, which is the tilting or turning of the gyro axis as a result of applied forces. The axis may therefore wobble when deflecting forces are applied. It may even fall over or topple when the applied force overpowers the gyroscopic inertia. The pilot reported failure of his King KI256 gyro/horizon shortly after deviations from controlled flight were noticed. As the KI256 supplies pitch and roll attitude information to the autopilot as well as directly to the pilot, it could not be determined when the autopilot was disconnected and the pilot assumed control. If the autopilot had been connected when the gyro toppled, it would have automatically disconnected when the gyro exceeded programmed parameters. The pilot had noticed problems with the unit on previous flights. He had the KI256 and the associated KC192 autopilot computer removed and bench tested before the occurrence flight. The KI256 signal outputs to the autopilot computer were found to be too unstable (jittery) to adjust, and the rotor bearings were noisy when operating. An overhaul was recommended but could not be performed until the following week, and a replacement or exchange instrument was not available. Because the KI256 display appeared to be within bench test parameters, the pilot requested that the units be reinstalled to complete the occurrence flight before further repairs were completed, with the knowledge that the autopilot problems had not been rectified. Section1.1.1 of Appendix A of the COMstated Autopilot must be serviceable for planned single pilot operations. The KI256 was manufactured in 1989 and was initially installed in an aircraft in 1994, then returned to the factory for overhaul in January1995. After overhaul, the instrument was installed in the occurrence aircraft in February1995. There is no record of the instrument having been serviced since this date and the factory seals from overhaul were intact. The aircraft TTIS since overhaul was 1236.3hours; a calendar time of 13years. There is no recommended overhaul life on these units, but the manufacturer has advised the TSB that average overhaul life is about three years. TSB examination of the KI256 gyro/horizon revealed significant internal wear and damage that pre-dated the occurrence: the rotor bearings and shaft had excessive wear and fretting damage; and the gimbal roll shaft had considerable fretting damage. Paint transfer from the rotor to the housing at impact did not exhibit smearing, indicating that the rotor was stationary at the time of impact. Examination of the other gyro instruments (the second gyro/horizon, both directional gyros, and both electrically operated turn coordinators) revealed scoring consistent with spinning at a high rate of speed at impact. Piper PA-46-310P and PA-46-350P Series Accident History About 1016 PA-46-310P and PA-46-350P aircraft have been built, of which 165 have been involved in serious accidents (16 per cent). Of these accidents, 12 involved in-flight breakups, of which 7 occurred in less than two years. The United States National Transportation Safety Board (NTSB) initiated a special investigation in 1990 on the airworthiness of the PA-46 series. Its report, published in 1992, concluded that there were no deficiencies in the design and construction, citing a combination of pilot error and omissions in the aeroplane's operating manual regarding the use of pitot heat in icing conditions. C-FKKH's right pitot heat switch was on, and the position of the left pitot heat switch could not be determined due to impact damage. Safety Management and Canadian Business Aviation Association Oversight The Canadian Business Aviation Association (CBAA) is an industry association representing business aircraft operators, ranging from small, one-person pilot/owner operations to large corporate flight departments. TC and the CBAA conducted a joint study of the feasibility of self-regulating business aviation in Canada and released a report in 2000 4 that concluded that it was feasible to amend subpart604 of the CARs to enable the transfer of regulatory responsibilities to the CBAA. The proposed regulatory approach included designing a set of performance-based rules linked directly to the operator's safety management system (SMS). In keeping with International Civil Aviation Organization (ICAO) developments, SMS is the strategy TC has adopted for improving safety within the commercial and business sectors of the aviation industry. These performance-based rules are contained in standards developed by the CBAA and called the Business Aviation Operational Safety Standards System (BA-OSS System). On 01January2003, the CBAA began to administer the certification of CARs subpart 604 operators in Canada. The main condition for obtaining a private operator certificate (POC) is that the operator must successfully undergo a third-party audit of its SMS. Audits are required to ensure that the operator complies with the CBAA's BA-OSS and that the operator's SMS meets the initial requirements. The CBAA does not recommend any particular auditor, nor does the CBAA facilitate contact. It does provide a list of accredited auditors and their contact information on its website. The CBAA takes pains to remove any perception of an employee-employer relationship between it and the accredited auditors. Notwithstanding the inherent conflict of interest or potential capture of the accredited auditors by the companies they serve, the CBAA is reluctant to direct auditors to cycle between operators based on what the CBAA perceives as interference in the auditor-client business relationship. Company Operations The aircraft was being operated by ADWEL Investments Ltd. (ADWEL) under a POC issued by the CBAA. A company operations manual (COM) was developed to conform to the POC program. It defined the duties and requirements of all persons associated with flight operations. In order to obtain the POC, a company SMS had to be developed and approved by the CBAA. The SMS program required the operator to analyze all aspects of the operation to identify all perceived hazards, define the characteristics of the hazard, the associated risks, and arrive at an effective mitigation strategy. A risk assessment was to be completed annually or whenever a safety issue dictated that a new risk assessment should be completed. There was no record of a risk assessment having been completed since the POC was issued in October2006. The contract pilot, hired to share flying duties when the primary pilot was not available, would not fly above FL250 because of the lack of quick-donning oxygen masks and would not take more than three passengers and two hours of fuel due to weight limitations on the aircraft. None of these operational situations were identified in either the original 2006 CBAA audit or the December2007 audit. Operators are responsible for contracting the services of an accredited auditor from a list supplied by the CBAA, and the agreement between the auditor and the operator is solely the responsibility of the two parties involved. Therefore, the operator controls the audits by choosing the auditor and negotiating the scope of the audit. On 05December2007, an audit was required due to a change in the executive structure at ADWEL. A partial audit was conducted which addressed 5 of the 124 items on the CBAA Certification Audit Checklist-2007. There is no reference in the CBAA POC program for a partial audit, nor are there any guidelines or checklists. The interval between the initial certification audit and the next mandatory audit had been assessed to be three years, the maximum interval allowed. Regulatory Framework for Business Aviation Other Occurrence In considering the transfer of regulatory responsibilities to a delegated authority, TC and the CBAA had identified a number of risks in their initial joint studies. To address these risks, the proposed approach included designing a set of performance-based rules directly linked to an operator's SMS. Recognizing that oversight of operators would still be required upon assuming regulatory responsibility, the CBAA would have to audit for operator compliance with the rules and standards, and develop and maintain a quality assurance program for its audit processes. On 11November2007, a business jet operated by Jetport Inc. on a flight from Hamilton, Ontario, to Fox Harbour, Nova Scotia, touched down seven feet short of the runway (TSB investigation report A07A0134). The right landing gear collapsed and the aeroplane came to a stop 1000feet further down and off the runway. Two occupants suffered serious injuries while the other eight occupants received minor injuries. Jetport held a POC issued by the CBAA under the auspices of subpart 604 of the CARs. The TSB investigated this occurrence and identified the following safety issues in its final report: The CBAA did not believe it could force its operators to comply with the requirements of the POC program and was not insisting that milestones for SMS implementation and development be followed. Therefore, some POC operators might never reach full SMS compliance. Contrary to the recommendations made in the TC/CBAA feasibility studies, the CBAA did not have a quality assurance program for its audit process. Since the inception of this new approach to regulating subpart 604 operators, TC did not exercise effective oversight of the CBAA, its accredited auditors or POC holders. It did not have a program established to observe or participate in audits conducted by the CBAAaccredited auditors in order to verify that this new approach was meeting its safety objectives. As a result, the TSB recommended that: The Canadian Business Aviation Association set safety management system implementation milestones for its certificate holders.A09-05 The Department of Transport ensure that the Canadian Business Aviation Association implement an effective quality assurance program for auditing certificate holders.A09-06